Unverified Commit 514f0041 authored by teor (Tim Wilson-Brown)'s avatar teor (Tim Wilson-Brown)
Browse files

Avoid disclosing exit IP addresses in exit policies by default 

From 0.2.7.2-alpha onwards, Exits would reject all the IP addresses
they knew about in their exit policy. But this may have disclosed
addresses that were otherwise unlisted.

Now, only advertised addresses are rejected by default by
ExitPolicyRejectPrivate. All known addresses are only rejected when
ExitPolicyRejectLocalInterfaces is explicitly set to 1.
parent 64ee7bcd

changes/bug18456

0 → 100644
+6 −0
Original line number Diff line number Diff line 
  o Major bugfixes (exit policies):

    - Avoid disclosing exit outbound bind addresses, configured port bind

      addresses, and local interface addresses in relay descriptors by

      default under ExitPolicyRejectPrivate. Instead, only reject these

      (otherwise unlisted) addresses if ExitPolicyRejectLocalInterfaces is set.

      Fixes bug 18456; bugfix on 0.2.7.2-alpha. Patch by teor.

doc/tor.1.txt

+18 −10
Original line number Diff line number Diff line
@@ -1701,15 +1701,16 @@ is non-zero): 
    used with accept6/reject6.) +

 +

    Private addresses are rejected by default (at the beginning of your exit

    policy), along with any configured primary public IPv4 and IPv6 addresses,

    and any public IPv4 and IPv6 addresses on any interface on the relay.

    policy), along with any configured primary public IPv4 and IPv6 addresses.

    These private addresses are rejected unless you set the

    ExitPolicyRejectPrivate config option to 0. For example, once you've done

    that, you could allow HTTP to 127.0.0.1 and block all other connections to

    internal networks with "accept 127.0.0.1:80,reject private:\*", though that

    may also allow connections to your own computer that are addressed to its

    public (external) IP address. See RFC 1918 and RFC 3330 for more details

    about internal and reserved IP address space. +

    about internal and reserved IP address space. See

    ExitPolicyRejectLocalInterfaces if you want to block every address on the

    relay, even those that aren't advertised in the descriptor. +

 +

    This directive can be specified multiple times so you don't have to put it

    all on one line. +
@@ -1739,16 +1740,23 @@ is non-zero): 
    IPv4 and IPv6 addresses.



[[ExitPolicyRejectPrivate]] **ExitPolicyRejectPrivate** **0**|**1**::

    Reject all private (local) networks, along with any configured public

    IPv4 and IPv6 addresses, at the beginning of your exit policy. (This

    includes the IPv4 and IPv6 addresses advertised by the relay, any

    OutboundBindAddress, and the bind addresses of any port options, such as

    ORPort and DirPort.) This also rejects any public IPv4 and IPv6 addresses

    on any interface on the relay. (If IPv6Exit is not set, all IPv6 addresses

    will be rejected anyway.)

    Reject all private (local) networks, along with the relay's advertised

    public IPv4 and IPv6 addresses, at the beginning of your exit policy.

    See above entry on ExitPolicy.

    (Default: 1)



[[ExitPolicyRejectLocalInterfaces]] **ExitPolicyRejectLocalInterfaces** **0**|**1**::

    Reject all IPv4 and IPv6 addresses that the relay knows about, at the

    beginning of your exit policy. This includes any OutboundBindAddress, the

    bind addresses of any port options, such as ControlPort or DNSPort, and any

    public IPv4 and IPv6 addresses on any interface on the relay. (If IPv6Exit

    is not set, all IPv6 addresses will be rejected anyway.)

    See above entry on ExitPolicy.

    This option is off by default, because it lists all public relay IP

    addresses in the ExitPolicy, even those relay operators might prefer not

    to disclose.

    (Default: 0)



[[IPv6Exit]] **IPv6Exit** **0**|**1**::

    If set, and we are an exit node, allow clients to use us for IPv6

    traffic. (Default: 0)

src/or/config.c

+3 −0
Original line number Diff line number Diff line
@@ -244,6 +244,7 @@ static config_var_t option_vars_[] = { 
  V(ExitNodes,                   ROUTERSET, NULL),

  V(ExitPolicy,                  LINELIST, NULL),

  V(ExitPolicyRejectPrivate,     BOOL,     "1"),

  V(ExitPolicyRejectLocalInterfaces, BOOL, "0"),

  V(ExitPortStatistics,          BOOL,     "0"),

  V(ExtendAllowPrivateAddresses, BOOL,     "0"),

  V(ExitRelay,                   AUTOBOOL, "auto"),
@@ -4320,6 +4321,8 @@ options_transition_affects_descriptor(const or_options_t *old_options, 
      old_options->ExitRelay != new_options->ExitRelay ||

      old_options->ExitPolicyRejectPrivate !=

        new_options->ExitPolicyRejectPrivate ||

      old_options->ExitPolicyRejectLocalInterfaces !=

        new_options->ExitPolicyRejectLocalInterfaces ||

      old_options->IPv6Exit != new_options->IPv6Exit ||

      !config_lines_eq(old_options->ORPort_lines,

                       new_options->ORPort_lines) ||

src/or/control.c

+1 −1
Original line number Diff line number Diff line
@@ -3025,7 +3025,7 @@ static const getinfo_item_t getinfo_items[] = { 
       " ExitPolicyRejectPrivate."),

  ITEM("exit-policy/reject-private/relay", policies,

       "The relay-specific rules appended to the configured exit policy by"

       " ExitPolicyRejectPrivate."),

       " ExitPolicyRejectPrivate and/or ExitPolicyRejectLocalInterfaces."),

  ITEM("exit-policy/full", policies, "The entire exit policy of onion router"),

  ITEM("exit-policy/ipv4", policies, "IPv4 parts of exit policy"),

  ITEM("exit-policy/ipv6", policies, "IPv6 parts of exit policy"),

src/or/main.c

+4 −4
Original line number Diff line number Diff line
@@ -2220,8 +2220,8 @@ ip_address_changed(int at_interface) 
{

  const or_options_t *options = get_options();

  int server = server_mode(options);

  int exit_reject_private = (server && options->ExitRelay

                             && options->ExitPolicyRejectPrivate);

  int exit_reject_interfaces = (server && options->ExitRelay

                                && options->ExitPolicyRejectLocalInterfaces);



  if (at_interface) {

    if (! server) {
@@ -2239,8 +2239,8 @@ ip_address_changed(int at_interface) 
  }



  /* Exit relays incorporate interface addresses in their exit policies when

   * ExitPolicyRejectPrivate is set */

  if (exit_reject_private || (server && !at_interface)) {

   * ExitPolicyRejectLocalInterfaces is set */

  if (exit_reject_interfaces || (server && !at_interface)) {

    mark_my_descriptor_dirty("IP address changed");

  }